What is the CVSS score of CVE-2025-14866?

CVE-2025-14866 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-14866?

Melapress Role Editor, a WordPress plugin used for user permission management, contains a critical authorization flaw (CVE-2025-14866) that could allow attackers to bypass access controls and…

How to fix or mitigate CVE-2025-14866?

Within 24 hours: Identify all WordPress installations using Melapress Role Editor versions up to 1.1.1 and document their business criticality. Within 7 days: Implement compensating controls (disable plugin if non-critical, restrict admin access via WAF/network controls, or isolate affected systems). Within 30 days: Monitor for vendor patch release and establish upgrade plan; evaluate alternative role management solutions if patch remains unavailable.

PHP CVE-2025-14866

HIGH

Incorrect Authorization (CWE-863)

2026-01-23 security@wordfence.com

WordPress Privilege Escalation PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 13:15 nvd

HIGH 8.8

DescriptionCVE.org

The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign themselves additional roles including Administrator.

AnalysisAI

Melapress Role Editor (WordPress plugin) versions up to 1.1.1. is affected by incorrect authorization (CVSS 8.8).

Technical ContextAI

This vulnerability (CWE-863: Incorrect Authorization) affects Melapress Role Editor (WordPress plugin). The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign themselves additional roles including Administrator.